modelcontextprotocol/ruby-sdk
Watch
1
0
Fork
You've already forked ruby-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #274 from koic/reject_missing_session_id

Browse source 
Reject POST requests without session ID in stateful mode
This commit is contained in:
Koichi ITO 2026-03-29 12:34:00 +09:00 • committed by GitHub
commit 8969edf4b9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 63 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

56
test/mcp/server/transports/streamable_http_transport_test.rb
View file

@ -272,6 +272,62 @@ module MCP
assert_equal "Missing session ID", body["error"]
end
test "rejects POST request without session ID in stateful mode" do
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "ping", id: "1" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 400, response[0]
body = JSON.parse(response[2][0])
assert_equal "Missing session ID", body["error"]
end
test "rejects notification without session ID in stateful mode" do
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "notifications/initialized" }.to_json,
)
response = @transport.handle_request(request)
assert_equal 400, response[0]
body = JSON.parse(response[2][0])
assert_equal "Missing session ID", body["error"]
end
test "rejects response without session ID in stateful mode" do
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", id: "1", result: {} }.to_json,
)
response = @transport.handle_request(request)
assert_equal 400, response[0]
body = JSON.parse(response[2][0])
assert_equal "Missing session ID", body["error"]
end
test "allows POST request without session ID in stateless mode" do
stateless_transport = StreamableHTTPTransport.new(@server, stateless: true)
request = create_rack_request(
"POST",
"/",
{ "CONTENT_TYPE" => "application/json" },
{ jsonrpc: "2.0", method: "ping", id: "1" }.to_json,
)
response = stateless_transport.handle_request(request)
assert_equal 200, response[0]
end
test "rejects duplicate SSE connection with 409" do
# Create a session
init_request = create_rack_request(